1 /***************************************************************************
2 * Copyright (C) 2008 digenius technology GmbH. *
4 * This program is free software; you can redistribute it and/or modify *
5 * it under the terms of the GNU General Public License as published by *
6 * the Free Software Foundation; either version 2 of the License, or *
7 * (at your option) any later version. *
9 * This program is distributed in the hope that it will be useful, *
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
12 * GNU General Public License for more details. *
14 * You should have received a copy of the GNU General Public License *
15 * along with this program; if not, write to the *
16 * Free Software Foundation, Inc., *
17 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
18 ***************************************************************************/
32 #define JTAG_DEBUG(expr ...) DEBUG(expr)
34 #define JTAG_DEBUG(expr ...) do {} while(0)
37 enum tap_state arm11_move_pi_to_si_via_ci[] =
39 TAP_E2I, TAP_UI, TAP_SDS, TAP_SIS, TAP_CI, TAP_SI
43 int arm11_add_ir_scan_vc(int num_fields, scan_field_t *fields, enum tap_state state)
45 if (cmd_queue_cur_state == TAP_PI)
46 jtag_add_pathmove(asizeof(arm11_move_pi_to_si_via_ci), arm11_move_pi_to_si_via_ci);
48 jtag_add_ir_scan(num_fields, fields, state);
52 enum tap_state arm11_move_pd_to_sd_via_cd[] =
54 TAP_E2D, TAP_UD, TAP_SDS, TAP_CD, TAP_SD
57 int arm11_add_dr_scan_vc(int num_fields, scan_field_t *fields, enum tap_state state)
59 if (cmd_queue_cur_state == TAP_PD)
60 jtag_add_pathmove(asizeof(arm11_move_pd_to_sd_via_cd), arm11_move_pd_to_sd_via_cd);
62 jtag_add_dr_scan(num_fields, fields, state);
67 /** Code de-clutter: Construct scan_field_t to write out a value
69 * \param arm11 Target state variable.
70 * \param num_bits Length of the data field
71 * \param out_data pointer to the data that will be sent out
72 * <em>(data is read when it is added to the JTAG queue)</em>
73 * \param in_data pointer to the memory that will receive data that was clocked in
74 * <em>(data is written when the JTAG queue is executed)</em>
75 * \param field target data structure that will be initialized
77 void arm11_setup_field(arm11_common_t * arm11, int num_bits, void * out_data, void * in_data, scan_field_t * field)
79 field->device = arm11->jtag_info.chain_pos;
80 field->num_bits = num_bits;
81 field->out_mask = NULL;
82 field->in_check_mask = NULL;
83 field->in_check_value = NULL;
84 field->in_handler = NULL;
85 field->in_handler_priv = NULL;
87 field->out_value = out_data;
88 field->in_value = in_data;
92 /** Write JTAG instruction register
94 * \param arm11 Target state variable.
95 * \param instr An ARM11 DBGTAP instruction. Use enum #arm11_instructions.
96 * \param state Pass the final TAP state or -1 for the default value (Pause-IR).
98 * \remarks This adds to the JTAG command queue but does \em not execute it.
100 void arm11_add_IR(arm11_common_t * arm11, u8 instr, enum tap_state state)
102 jtag_device_t *device = jtag_get_device(arm11->jtag_info.chain_pos);
104 if (buf_get_u32(device->cur_instr, 0, 5) == instr)
106 JTAG_DEBUG("IR <= 0x%02x SKIPPED", instr);
110 JTAG_DEBUG("IR <= 0x%02x", instr);
114 arm11_setup_field(arm11, 5, &instr, NULL, &field);
116 arm11_add_ir_scan_vc(1, &field, state == -1 ? TAP_PI : state);
119 /** Verify shifted out data from Scan Chain Register (SCREG)
120 * Used as parameter to scan_field_t::in_handler in
121 * arm11_add_debug_SCAN_N().
124 static int arm11_in_handler_SCAN_N(u8 *in_value, void *priv, struct scan_field_s *field)
126 /** \todo TODO: clarify why this isnt properly masked in jtag.c jtag_read_buffer() */
127 u8 v = *in_value & 0x1F;
131 LOG_ERROR("'arm11 target' JTAG communication error SCREG SCAN OUT 0x%02x (expected 0x10)", v);
135 JTAG_DEBUG("SCREG SCAN OUT 0x%02x", v);
139 /** Select and write to Scan Chain Register (SCREG)
141 * This function sets the instruction register to SCAN_N and writes
142 * the data register with the selected chain number.
144 * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301f/Cacbjhfg.html
146 * \param arm11 Target state variable.
147 * \param chain Scan chain that will be selected.
148 * \param state Pass the final TAP state or -1 for the default
151 * The chain takes effect when Update-DR is passed (usually when subsequently
152 * the INTEXT/EXTEST instructions are written).
154 * \warning (Obsolete) Using this twice in a row will \em fail. The first call will end
155 * in Pause-DR. The second call, due to the IR caching, will not
156 * go through Capture-DR when shifting in the new scan chain number.
157 * As a result the verification in arm11_in_handler_SCAN_N() must
160 * \remarks This adds to the JTAG command queue but does \em not execute it.
163 void arm11_add_debug_SCAN_N(arm11_common_t * arm11, u8 chain, enum tap_state state)
165 JTAG_DEBUG("SCREG <= 0x%02x", chain);
167 arm11_add_IR(arm11, ARM11_SCAN_N, -1);
171 arm11_setup_field(arm11, 5, &chain, NULL, &field);
173 field.in_handler = arm11_in_handler_SCAN_N;
175 arm11_add_dr_scan_vc(1, &field, state == -1 ? TAP_PD : state);
178 /** Write an instruction into the ITR register
180 * \param arm11 Target state variable.
181 * \param inst An ARM11 processor instruction/opcode.
182 * \param flag Optional parameter to retrieve the InstCompl flag
183 * (this will be written when the JTAG chain is executed).
184 * \param state Pass the final TAP state or -1 for the default
185 * value (Run-Test/Idle).
187 * \remarks By default this ends with Run-Test/Idle state
188 * and causes the instruction to be executed. If
189 * a subsequent write to DTR is needed before
190 * executing the instruction then TAP_PD should be
191 * passed to \p state.
193 * \remarks This adds to the JTAG command queue but does \em not execute it.
195 void arm11_add_debug_INST(arm11_common_t * arm11, u32 inst, u8 * flag, enum tap_state state)
197 JTAG_DEBUG("INST <= 0x%08x", inst);
201 arm11_setup_field(arm11, 32, &inst, NULL, itr + 0);
202 arm11_setup_field(arm11, 1, NULL, flag, itr + 1);
204 arm11_add_dr_scan_vc(asizeof(itr), itr, state == -1 ? TAP_RTI : state);
207 /** Read the Debug Status and Control Register (DSCR)
211 * \param arm11 Target state variable.
212 * \return DSCR content
214 * \remarks This is a stand-alone function that executes the JTAG command queue.
216 u32 arm11_read_DSCR(arm11_common_t * arm11)
218 arm11_add_debug_SCAN_N(arm11, 0x01, -1);
220 arm11_add_IR(arm11, ARM11_INTEST, -1);
223 scan_field_t chain1_field;
225 arm11_setup_field(arm11, 32, NULL, &dscr, &chain1_field);
227 arm11_add_dr_scan_vc(1, &chain1_field, TAP_PD);
229 jtag_execute_queue();
231 if (arm11->last_dscr != dscr)
232 JTAG_DEBUG("DSCR = %08x (OLD %08x)", dscr, arm11->last_dscr);
234 arm11->last_dscr = dscr;
239 /** Write the Debug Status and Control Register (DSCR)
243 * \param arm11 Target state variable.
244 * \param dscr DSCR content
246 * \remarks This is a stand-alone function that executes the JTAG command queue.
248 void arm11_write_DSCR(arm11_common_t * arm11, u32 dscr)
250 arm11_add_debug_SCAN_N(arm11, 0x01, -1);
252 arm11_add_IR(arm11, ARM11_EXTEST, -1);
254 scan_field_t chain1_field;
256 arm11_setup_field(arm11, 32, &dscr, NULL, &chain1_field);
258 arm11_add_dr_scan_vc(1, &chain1_field, TAP_PD);
260 jtag_execute_queue();
262 JTAG_DEBUG("DSCR <= %08x (OLD %08x)", dscr, arm11->last_dscr);
264 arm11->last_dscr = dscr;
269 /** Get the debug reason from Debug Status and Control Register (DSCR)
271 * \param dscr DSCR value to analyze
272 * \return Debug reason
275 enum target_debug_reason arm11_get_DSCR_debug_reason(u32 dscr)
277 switch (dscr & ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_MASK)
279 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_HALT:
280 LOG_INFO("Debug entry: JTAG HALT");
281 return DBG_REASON_DBGRQ;
283 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_BREAKPOINT:
284 LOG_INFO("Debug entry: breakpoint");
285 return DBG_REASON_BREAKPOINT;
287 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_WATCHPOINT:
288 LOG_INFO("Debug entry: watchpoint");
289 return DBG_REASON_WATCHPOINT;
291 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_BKPT_INSTRUCTION:
292 LOG_INFO("Debug entry: BKPT instruction");
293 return DBG_REASON_BREAKPOINT;
295 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_EDBGRQ:
296 LOG_INFO("Debug entry: EDBGRQ signal");
297 return DBG_REASON_DBGRQ;
299 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_VECTOR_CATCH:
300 LOG_INFO("Debug entry: VCR vector catch");
301 return DBG_REASON_BREAKPOINT;
304 LOG_INFO("Debug entry: unknown");
305 return DBG_REASON_DBGRQ;
311 /** Prepare the stage for ITR/DTR operations
312 * from the arm11_run_instr... group of functions.
314 * Put arm11_run_instr_data_prepare() and arm11_run_instr_data_finish()
315 * around a block of arm11_run_instr_... calls.
317 * Select scan chain 5 to allow quick access to DTR. When scan
318 * chain 4 is needed to put in a register the ITRSel instruction
319 * shortcut is used instead of actually changing the Scan_N
322 * \param arm11 Target state variable.
325 void arm11_run_instr_data_prepare(arm11_common_t * arm11)
327 arm11_add_debug_SCAN_N(arm11, 0x05, -1);
330 /** Cleanup after ITR/DTR operations
331 * from the arm11_run_instr... group of functions
333 * Put arm11_run_instr_data_prepare() and arm11_run_instr_data_finish()
334 * around a block of arm11_run_instr_... calls.
336 * Any RTI can lead to an instruction execution when
337 * scan chains 4 or 5 are selected and the IR holds
338 * INTEST or EXTEST. So we must disable that before
339 * any following activities lead to an RTI.
341 * \param arm11 Target state variable.
344 void arm11_run_instr_data_finish(arm11_common_t * arm11)
346 arm11_add_debug_SCAN_N(arm11, 0x00, -1);
350 /** Execute one or multiple instructions via ITR
352 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
354 * \param arm11 Target state variable.
355 * \param opcode Pointer to sequence of ARM opcodes
356 * \param count Number of opcodes to execute
359 void arm11_run_instr_no_data(arm11_common_t * arm11, u32 * opcode, size_t count)
361 arm11_add_IR(arm11, ARM11_ITRSEL, -1);
365 arm11_add_debug_INST(arm11, *opcode++, NULL, TAP_RTI);
371 arm11_add_debug_INST(arm11, 0, &flag, count ? TAP_RTI : TAP_PD);
373 jtag_execute_queue();
381 /** Execute one instruction via ITR
383 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
385 * \param arm11 Target state variable.
386 * \param opcode ARM opcode
389 void arm11_run_instr_no_data1(arm11_common_t * arm11, u32 opcode)
391 arm11_run_instr_no_data(arm11, &opcode, 1);
395 /** Execute one instruction via ITR repeatedly while
396 * passing data to the core via DTR on each execution.
398 * The executed instruction \em must read data from DTR.
400 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
402 * \param arm11 Target state variable.
403 * \param opcode ARM opcode
404 * \param data Pointer to the data words to be passed to the core
405 * \param count Number of data words and instruction repetitions
408 void arm11_run_instr_data_to_core(arm11_common_t * arm11, u32 opcode, u32 * data, size_t count)
410 arm11_add_IR(arm11, ARM11_ITRSEL, -1);
412 arm11_add_debug_INST(arm11, opcode, NULL, TAP_PD);
414 arm11_add_IR(arm11, ARM11_EXTEST, -1);
416 scan_field_t chain5_fields[3];
422 arm11_setup_field(arm11, 32, &Data, NULL, chain5_fields + 0);
423 arm11_setup_field(arm11, 1, NULL, &Ready, chain5_fields + 1);
424 arm11_setup_field(arm11, 1, NULL, &nRetry, chain5_fields + 2);
432 arm11_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, TAP_RTI);
433 jtag_execute_queue();
435 JTAG_DEBUG("DTR Ready %d nRetry %d", Ready, nRetry);
442 arm11_add_IR(arm11, ARM11_INTEST, -1);
448 arm11_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, TAP_PD);
449 jtag_execute_queue();
451 JTAG_DEBUG("DTR Data %08x Ready %d nRetry %d", Data, Ready, nRetry);
456 /** JTAG path for arm11_run_instr_data_to_core_noack
458 * The repeated TAP_RTI's do not cause a repeated execution
459 * if passed without leaving the state.
461 * Since this is more than 7 bits (adjustable via adding more
462 * TAP_RTI's) it produces an artificial delay in the lower
463 * layer (FT2232) that is long enough to finish execution on
464 * the core but still shorter than any manually inducible delays.
467 enum tap_state arm11_MOVE_PD_RTI_PD_with_delay[] =
469 TAP_E2D, TAP_UD, TAP_RTI, TAP_RTI, TAP_RTI, TAP_SDS, TAP_CD, TAP_SD
474 /** Execute one instruction via ITR repeatedly while
475 * passing data to the core via DTR on each execution.
477 * No Ready check during transmission.
479 * The executed instruction \em must read data from DTR.
481 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
483 * \param arm11 Target state variable.
484 * \param opcode ARM opcode
485 * \param data Pointer to the data words to be passed to the core
486 * \param count Number of data words and instruction repetitions
489 void arm11_run_instr_data_to_core_noack(arm11_common_t * arm11, u32 opcode, u32 * data, size_t count)
491 arm11_add_IR(arm11, ARM11_ITRSEL, -1);
493 arm11_add_debug_INST(arm11, opcode, NULL, TAP_PD);
495 arm11_add_IR(arm11, ARM11_EXTEST, -1);
497 scan_field_t chain5_fields[3];
499 arm11_setup_field(arm11, 32, NULL/*&Data*/, NULL, chain5_fields + 0);
500 arm11_setup_field(arm11, 1, NULL, NULL /*&Ready*/, chain5_fields + 1);
501 arm11_setup_field(arm11, 1, NULL, NULL, chain5_fields + 2);
503 u8 Readies[count + 1];
504 u8 * ReadyPos = Readies;
508 chain5_fields[0].out_value = (void *)(data++);
509 chain5_fields[1].in_value = ReadyPos++;
513 jtag_add_dr_scan(asizeof(chain5_fields), chain5_fields, TAP_PD);
514 jtag_add_pathmove(asizeof(arm11_MOVE_PD_RTI_PD_with_delay),
515 arm11_MOVE_PD_RTI_PD_with_delay);
519 jtag_add_dr_scan(asizeof(chain5_fields), chain5_fields, TAP_RTI);
523 arm11_add_IR(arm11, ARM11_INTEST, -1);
525 chain5_fields[0].out_value = 0;
526 chain5_fields[1].in_value = ReadyPos++;
528 arm11_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, TAP_PD);
530 jtag_execute_queue();
532 size_t error_count = 0;
535 for (i = 0; i < asizeof(Readies); i++)
544 LOG_ERROR("Transfer errors " ZU, error_count);
548 /** Execute an instruction via ITR while handing data into the core via DTR.
550 * The executed instruction \em must read data from DTR.
552 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
554 * \param arm11 Target state variable.
555 * \param opcode ARM opcode
556 * \param data Data word to be passed to the core via DTR
559 void arm11_run_instr_data_to_core1(arm11_common_t * arm11, u32 opcode, u32 data)
561 arm11_run_instr_data_to_core(arm11, opcode, &data, 1);
565 /** Execute one instruction via ITR repeatedly while
566 * reading data from the core via DTR on each execution.
568 * The executed instruction \em must write data to DTR.
570 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
572 * \param arm11 Target state variable.
573 * \param opcode ARM opcode
574 * \param data Pointer to an array that receives the data words from the core
575 * \param count Number of data words and instruction repetitions
578 void arm11_run_instr_data_from_core(arm11_common_t * arm11, u32 opcode, u32 * data, size_t count)
580 arm11_add_IR(arm11, ARM11_ITRSEL, -1);
582 arm11_add_debug_INST(arm11, opcode, NULL, TAP_RTI);
584 arm11_add_IR(arm11, ARM11_INTEST, -1);
586 scan_field_t chain5_fields[3];
592 arm11_setup_field(arm11, 32, NULL, &Data, chain5_fields + 0);
593 arm11_setup_field(arm11, 1, NULL, &Ready, chain5_fields + 1);
594 arm11_setup_field(arm11, 1, NULL, &nRetry, chain5_fields + 2);
600 arm11_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, count ? TAP_RTI : TAP_PD);
601 jtag_execute_queue();
603 JTAG_DEBUG("DTR Data %08x Ready %d nRetry %d", Data, Ready, nRetry);
611 /** Execute one instruction via ITR
612 * then load r0 into DTR and read DTR from core.
614 * The first executed instruction (\p opcode) should write data to r0.
616 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
618 * \param arm11 Target state variable.
619 * \param opcode ARM opcode to write r0 with the value of interest
620 * \param data Pointer to a data word that receives the value from r0 after \p opcode was executed.
623 void arm11_run_instr_data_from_core_via_r0(arm11_common_t * arm11, u32 opcode, u32 * data)
625 arm11_run_instr_no_data1(arm11, opcode);
627 /* MCR p14,0,R0,c0,c5,0 (move r0 -> wDTR -> local var) */
628 arm11_run_instr_data_from_core(arm11, 0xEE000E15, data, 1);
631 /** Load data into core via DTR then move it to r0 then
632 * execute one instruction via ITR
634 * The final executed instruction (\p opcode) should read data from r0.
636 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
638 * \param arm11 Target state variable.
639 * \param opcode ARM opcode to read r0 act upon it
640 * \param data Data word that will be written to r0 before \p opcode is executed
643 void arm11_run_instr_data_to_core_via_r0(arm11_common_t * arm11, u32 opcode, u32 data)
645 /* MRC p14,0,r0,c0,c5,0 */
646 arm11_run_instr_data_to_core1(arm11, 0xEE100E15, data);
648 arm11_run_instr_no_data1(arm11, opcode);
651 /** Apply reads and writes to scan chain 7
653 * \see arm11_sc7_action_t
655 * \param arm11 Target state variable.
656 * \param actions A list of read and/or write instructions
657 * \param count Number of instructions in the list.
660 void arm11_sc7_run(arm11_common_t * arm11, arm11_sc7_action_t * actions, size_t count)
662 arm11_add_debug_SCAN_N(arm11, 0x07, -1);
664 arm11_add_IR(arm11, ARM11_EXTEST, -1);
666 scan_field_t chain7_fields[3];
675 arm11_setup_field(arm11, 1, &nRW, &Ready, chain7_fields + 0);
676 arm11_setup_field(arm11, 32, &DataOut, &DataIn, chain7_fields + 1);
677 arm11_setup_field(arm11, 7, &AddressOut, &AddressIn, chain7_fields + 2);
680 for (i = 0; i < count + 1; i++)
684 nRW = actions[i].write ? 1 : 0;
685 DataOut = actions[i].value;
686 AddressOut = actions[i].address;
697 JTAG_DEBUG("SC7 <= Address %02x Data %08x nRW %d", AddressOut, DataOut, nRW);
699 arm11_add_dr_scan_vc(asizeof(chain7_fields), chain7_fields, TAP_PD);
700 jtag_execute_queue();
702 JTAG_DEBUG("SC7 => Address %02x Data %08x Ready %d", AddressIn, DataIn, Ready);
704 while (!Ready); /* 'nRW' is 'Ready' on read out */
708 if (actions[i - 1].address != AddressIn)
710 LOG_WARNING("Scan chain 7 shifted out unexpected address");
713 if (!actions[i - 1].write)
715 actions[i - 1].value = DataIn;
719 if (actions[i - 1].value != DataIn)
721 LOG_WARNING("Scan chain 7 shifted out unexpected data");
728 for (i = 0; i < count; i++)
730 JTAG_DEBUG("SC7 %02d: %02x %s %08x", i, actions[i].address, actions[i].write ? "<=" : "=>", actions[i].value);
734 /** Clear VCR and all breakpoints and watchpoints via scan chain 7
736 * \param arm11 Target state variable.
739 void arm11_sc7_clear_vbw(arm11_common_t * arm11)
741 arm11_sc7_action_t clear_bw[arm11->brp + arm11->wrp + 1];
742 arm11_sc7_action_t * pos = clear_bw;
745 for (i = 0; i < asizeof(clear_bw); i++)
747 clear_bw[i].write = true;
748 clear_bw[i].value = 0;
752 for (i = 0; i < arm11->brp; i++)
753 (pos++)->address = ARM11_SC7_BCR0 + i;
757 for (i = 0; i < arm11->wrp; i++)
758 (pos++)->address = ARM11_SC7_WCR0 + i;
761 (pos++)->address = ARM11_SC7_VCR;
763 arm11_sc7_run(arm11, clear_bw, asizeof(clear_bw));
766 /** Write VCR register
768 * \param arm11 Target state variable.
769 * \param value Value to be written
771 void arm11_sc7_set_vcr(arm11_common_t * arm11, u32 value)
773 arm11_sc7_action_t set_vcr;
775 set_vcr.write = true;
776 set_vcr.address = ARM11_SC7_VCR;
777 set_vcr.value = value;
780 arm11_sc7_run(arm11, &set_vcr, 1);
785 /** Read word from address
787 * \param arm11 Target state variable.
788 * \param address Memory address to be read
789 * \param result Pointer where to store result
792 void arm11_read_memory_word(arm11_common_t * arm11, u32 address, u32 * result)
794 arm11_run_instr_data_prepare(arm11);
796 /* MRC p14,0,r0,c0,c5,0 (r0 = address) */
797 arm11_run_instr_data_to_core1(arm11, 0xee100e15, address);
799 /* LDC p14,c5,[R0],#4 (DTR = [r0]) */
800 arm11_run_instr_data_from_core(arm11, 0xecb05e01, result, 1);
802 arm11_run_instr_data_finish(arm11);